What is the CVSS score of CVE-2026-13821?

CVE-2026-13821 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13821?

Google Chrome desktop versions prior to 150.0.7871.47 contain a high-severity remote code execution vulnerability in the Canvas component that executes arbitrary code when users visit a crafted…. A patch is available.

How to fix or mitigate CVE-2026-13821?

Within 24 hours: Issue mandatory update notice; audit Chrome versions across organization. Within 7 days: Deploy Chrome 150.0.7871.47 or later via patch management; block affected versions from accessing internal resources. Within 30 days: Verify full deployment completion and update endpoint detection rules to flag Chrome versions prior to 150.0.7871.47.

Google Chrome CVE-2026-13821

EUVD-2026-40507 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-vqg7-9mq8-55wr

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) needs the victim to open it (UI:R); impact is full but confined to the renderer sandbox, so Scope stays Unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:31 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in the Canvas component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page), but no authentication. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).

Technical ContextAI

The vulnerability lives in Chrome's Canvas subsystem, the HTML5 2D drawing API implemented within Blink/Chromium and exposed to untrusted web content via JavaScript. The root cause is CWE-416 (Use After Free): a memory object backing a Canvas operation is freed while a dangling reference remains reachable, so subsequent use of that reference lets an attacker reallocate the freed region with controlled data and corrupt program state. Because Canvas is directly scriptable from any web page, an attacker can drive the allocation/free/re-use sequence precisely from JavaScript. The only affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fix), and the exploit is bounded to the renderer process sandbox (Scope: Unchanged in the CVSS vector), meaning a further sandbox-escape chain would be needed for full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel (Settings > About Chrome triggers the update, then relaunch to apply). This is the primary and complete fix; monitor the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the bug at https://issues.chromium.org/issues/513142445. In managed fleets, push the update through your enterprise update policy or software distribution to guarantee relaunch. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites and, for high-risk users, enabling Chrome's Enhanced Safe Browsing and the Site Isolation/strict renderer sandbox defaults - the trade-off is added friction and no guarantee against a crafted page, so these are stopgaps only until the update is deployed. Users of other Chromium-based browsers should apply their vendor's equivalent update once released.